Search

The Fed. Housing Finance Agency (FHFA) relies extensively on computerized systems to carry out its mission to provide effective supervision, regulation, and housing mission oversight of the Fed. Nat. Mortgage Assoc. (Fannie Mae), the Fed. Home Loan Mortgage Corp. (Freddie Mac), and the fed. home loan banks. Effective info. security controls (ISC) are essential to ensure that FHFA's financial info. is protected from inadvertent or deliberate misuse, disclosure, or destruction. This report assessed the effectiveness of the agency's ISC to ensure the confidentiality, integrity, and availability of the agency's financial info. The report examined FHFA ISC policies, procedures, and other documents. Charts and tables.

Over the past several years, federal agencies have rapidly adopted the use of wireless networks (WN) for their info. systems. This report: (1) identifies leading practices and state-of-the-art technologies for deploying and monitoring secure WN; and (2) assesses agency efforts to secure WN, incl. their vulnerability to attack. To do so, the auditor reviewed publications and interviewed experts in wireless security. He also interviewed agency officials on wireless security at 24 major federal agencies and conducted additional testing at 5 agencies. This report identifies a range of leading security practices for deploying and monitoring secure WN and technologies that can help secure these networks. Illus. This is a print on demand report.

Without proper safeguards, fed. agencies' computer systems are vulnerable to intrusions by individuals and groups who have malicious intentions and can obtain sensitive info., commit fraud, disrupt operations, or launch attacks against other computer systems and networks. Concerned by reports of significant weaknesses in fed. systems, Congress passed the Fed. Info. Security Mgmt. Act (FISMA), which permanently authorized and strengthened info. security program, evaluation, and annual reporting requirements for fed. agencies. This is testimony on a draft report on: (1) the adequacy and effectiveness of fed. agencies' info. security policies and practices; and (2) their implementation of FISMA requirements.

Information security is a critical consideration for any organization that depends on info. systems and computer networks to carry out its mission or business. It is especially important for gov¿t. agencies, where maintaining the public's trust is essential. The need for a vigilant approach to info. security has been demonstrated by the pervasive and sustained computerbased (cyber) attacks againimpactst the U.S. and others that continue to pose a potentially devastating to systems and the operations and critical infrastructures that they support. This report describes: (1) cyber threats to fed. info. systems and cyberbased critical infrastructures; and (2) control deficiencies that make these systems and infrastructures vulnerable to those threats. Ill.

The control systems that regulate the nation¿s critical infrastructures face risks of cyber threats, system vulnerabilities, and potential attacks. Securing these systems is therefore vital to ensuring national security, economic well-being, and public health and safety. While most critical infrastructures are privately owned, the Tennessee Valley Authority (TVA), a fed. corp. and the nation¿s largest public power company, provides power and other services to a large swath of the American Southeast. This testimony discusses the security controls in place over TVA¿s critical infrastructure control system. The author examined the security practices in place at TVA facilities, and analyzed the agency¿s information security policies, plans, and procedures.

In response to the ongoing threats to federal systems and operations posed by cyber attacks, Pres. Bush established the Comprehensive National Cybersecurity Initiative (CNCI) in 2008. This initiative consists of a set of projects aimed at reducing vulnerabilities, protecting against intrusions, and anticipating future threats. This report determined: (1) what actions have been taken to develop interagency mechanisms to plan and coordinate CNCI activities; and (2) what challenges CNCI faces in achieving its objectives related to securing federal information systems. To do this, the report reviewed CNCI plans, policies, and other documentation and interviewed officials at OMB, DHS, and the ODNI, among other agencies. Charts and tables.

Discusses the cyber threats to critical infrastructure and the Amer. economy. Pervasive and sustained cyber attacks against the U.S. continue to pose a potentially devastating impact on fed. and non-fed. systems and operations. In Feb. 2011, the Dir. of National Intelligence testified that, in the past year, there had been a dramatic increase in malicious cyber activity targeting U.S. computers and networks, incl. a more than tripling of the vol. of malicious software since 2009. This testimony describes: (1) cyber threats to cyber-reliant critical infrastructures and federal information systems; and (2) the continuing challenges federal agencies face in protecting the nation's cyber-reliant critical infrastructures and federal systems. A print on demand report.

Fed. agencies are facing a set of cybersecurity threats that are the result of increasingly sophisticated methods of attack & the blending of once distinct types of attack into more complex & damaging forms. Examples of these threats include: spam (unsolicited commercial e-mail), phishing (fraudulent messages to obtain personal or sensitive data), & spyware (software that monitors user activity without user knowledge or consent). This report determines: the potential risks to fed. systems from these emerging cybersecurity threats; the fed. agencies' perceptions of risk & their actions to mitigate them, fed. & private-sector actions to address the threats on a nat. level; & governmentwide challenges to protecting fed. systems from these threats. Illus.

This is a print on demand edition of a hard to find publication. Approximately 90 percent of all federal background investigations are provided by OPM¿s Federal Investigative Services (FIS) division. In fiscal year 2009, FIS conducted over 2 million investigations of varying types, making the organization a major steward of personal information on U.S. citizens. This report: (1) describes how OPM uses personally identifiable information (PII) in conducting background investigations; and (2) assesses the extent to which OPM's privacy policies and procedures for protecting PII related to investigations meet statutory requirements and align with widely accepted privacy practices. The report compared OPM and FIS policies and procedures with key privacy laws and widely accepted practices. Illustrations.

Pervasive and sustained cyber attacks continue to pose a potentially devastating threat to the systems and operations of the fed. government. In recent months, fed. officials have cited the continued efforts of foreign nations and criminals to target government and private sector networks; terrorist groups have expressed a desire to use cyber attacks to target the U.S.; and press accounts have reported attacks on the Web sites of government agencies. This statement describes: (1) cyber threats to fed. information systems and cyber-based critical infrastructures; (2) control deficiencies at fed. agencies that make these systems and infrastructures vulnerable to cyber threats; and (3) opportunities that exist for improving fed. cybersecurity.